Skip to content

Enforce provider transport boundaries and reliable validation - #7

Open
murillo-consulting wants to merge 2 commits into
mainfrom
codex/reliability-security-review
Open

murillo-consulting wants to merge 2 commits into
mainfrom
codex/reliability-security-review

Conversation

@murillo-consulting

@murillo-consulting murillo-consulting commented Sep 5, 2026 •

Copy link
Copy Markdown
Owner

Provider clients followed HTTP redirects and could silently discard custom TLS settings after initialization failure. Gate now refuses automatic provider redirects and fails closed if the requested transport cannot be built. Configure final provider URLs directly.

Updates h2 from 0.4.14 to 0.4.16 to resolve RUSTSEC-2026-0258 reported by the repository quality gate.

The validate command now returns an error when initialization fails or a checked router model has no healthy provider, while still accepting a working fallback. Pins third-party workflow actions to verified commits and adds sourced adoption guidance, compatibility notes and a prioritized roadmap.

Validation: 1,435 default-feature library tests passed; the provider subset also passed without default features. Rustfmt, all-target Clippy with warnings denied, workflow actionlint and changed-document Markdown checks passed. New tests cover five redirect statuses, direct requests, unusable models and healthy fallback. No live provider calls, cross-platform builds or full Kubernetes E2E run were performed locally. No configuration/state migration; revert the commit to roll back.

@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Sep 5, 2026 •

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review ✅ Completed 2026-09-05T11:42:44.592110Z 9c304ed PR opened
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 9c304ed9a3

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread src/commands/validate.rs

let results = preset::validate_config(config, &registry).await;
preset::print_validation_results(&results);
require_healthy_models(&results)

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Validate pass-through router models before failing

When router.default (or another router role) intentionally names a model absent from [[models]] and an enabled provider has pass_through = true, the server validly routes that model through resolve_pass_through_mappings in src/server/helpers.rs, but validate_config produces a synthetic “Model not found” result. This new unconditional health check therefore makes gate validate exit unsuccessfully for a working, documented pass-through configuration; validation should derive and probe pass-through mappings through the same resolution path before enforcing this result.

Useful? React with 👍 / 👎.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant